1038-00010 · Cascade Retail Holdings · Contracts & Vendor Management

thornbridge-negotiation-issues-redline-commentary.docx DOCUMENT Finance & Banking

16 / 38 ← → ✕

Contract analysis Extract to table

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

INTERNAL MEMORANDUM

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, New York 10022

Matter Number: 1038-00010

To: Kevin Ostrowski, Partner, Privacy & Data Security

From: Alan Burke, Senior Associate, Privacy & Data Security

Date: October 8, 2025

Re: Thornbridge Media Corp. — Negotiation Issues List and Redline Commentary on Counterproposal to Restructured Data-Sharing Agreement

PRIVILEGE LEGEND: This memorandum is a privileged and confidential attorney work-product communication prepared in connection with Calderwood & Harkness LLP's representation of Cascade Retail Holdings Inc. ("Cascade" or the "Client"). It is not intended for disclosure to third parties and should not be forwarded or produced without prior approval of counsel. This memorandum reflects the mental impressions, conclusions, opinions, and legal theories of counsel and is protected from disclosure under Federal Rule of Civil Procedure 26(b)(3), the attorney-client privilege, and applicable state-law equivalents.

I. Executive Summary

The purpose of this memorandum is to analyze the counterproposal received on October 3, 2025 from Victor Sandoval of Kellner Park & Associates LLP ("KP&A"), located at 555 Mission Street, 32nd Floor, San Francisco, California 94105, on behalf of Thornbridge Media Corp. ("Thornbridge"), in response to the restructured Data-Sharing Agreement ("DSA") that Calderwood & Harkness LLP ("C&H") circulated on behalf of Cascade Retail Holdings Inc. ("Cascade") on September 18, 2025.

Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner. Cascade's fiscal year 2024 spend with Thornbridge was approximately $18.4 million, making this one of Cascade's most commercially significant data-sharing relationships. Thornbridge is a Nevada corporation headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117. Its Chief Executive Officer is Robert Shin and its General Counsel is Leah Voss.

The DSA restructuring is a critical workstream within Cascade's broader privacy-compliance remediation program. This workstream was initiated following the gap-analysis report delivered by C&H on August 15, 2025, which identified the Thornbridge relationship as the highest-priority data-sharing arrangement requiring restructuring for compliance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and eighteen additional applicable state privacy statutes. The target execution date for the restructured DSA is October 31, 2025, consistent with the Phase 1 milestone schedule established in the remediation program timeline.

Following a comprehensive review of the KP&A counterproposal, C&H has identified four principal negotiation issues that require Client attention and strategic decision-making. Each issue is analyzed below with a description of the C&H position as set forth in the initial draft, the Thornbridge/KP&A position as reflected in the counterproposal redline, a legal risk assessment, and a recommended negotiation strategy including primary positions, fallback positions, and non-negotiable "red lines." The four principal issues are:

1. Combined-Data Rights (Section 4.2 of the Draft DSA) — Thornbridge's proposal to delete the combination prohibition and replace it with a permissive combination right, subject only to de-identification within 90 days.

2. Real-Time GPC Signal Pass-Through (Section 7.3 of the Draft DSA) — Thornbridge's proposal to substitute weekly batch processing for real-time Global Privacy Control signal suppression.

3. Audit Rights (Section 9.1 of the Draft DSA) — Thornbridge's proposal to reduce audit frequency, limit audit duration, require mutual agreement on auditor selection, and permit SOC 2 Type II report substitution.

4. Indemnification Scope for Regulatory Fines (Section 11.2 of the Draft DSA) — Thornbridge's proposal to exclude regulatory fines and penalties from indemnification, or alternatively to impose a trailing 12-month fee cap.

In addition, this memorandum addresses five lower-priority redline issues raised by KP&A, for which C&H recommends compromise positions that do not materially affect Cascade's compliance posture.

Recommendation: Before the next negotiation session, C&H recommends scheduling a call with Diana Polk (Associate General Counsel and Interim Chief Privacy Officer, Cascade) and Jason Leclaire (Vice President, Marketing & Customer Engagement, Cascade) to confirm Cascade's commercial parameters and risk tolerance on each of the four principal issues. In particular, Mr. Leclaire's input will be essential to calibrate the commercial impact of the combined-data restriction (Issue 1) on Cascade's programmatic-advertising performance and to ensure that Cascade's negotiation positions reflect an informed understanding of the business tradeoffs involved.

II. Background

A. Relationship Overview

Thornbridge Media Corp. is a programmatic-advertising and audience-targeting platform that processes consumer behavioral data received from Cascade. The Thornbridge relationship is one of Cascade's longest-standing advertising partnerships, predating many of the state privacy statutes that now govern the underlying data flows. Thornbridge provides Cascade with audience-modeling, lookalike-audience creation, programmatic ad buying, and cross-channel campaign optimization services. These services are integral to Cascade's digital-marketing operations, and as noted above, Cascade's FY2024 spend with Thornbridge was approximately $18.4 million.

The data flows between Cascade and Thornbridge are extensive and multifaceted. They include the following categories of consumer data:

• Consumer browsing activity: Data regarding consumers' interactions with Cascade's e-commerce properties, including page views, product searches, time-on-page metrics, and click-through behavior.

• Purchase history: Transaction-level data, including items purchased, purchase amounts, dates of purchase, payment method categories, and associated product-category codes.

• Loyalty-program engagement data: Data from Cascade Rewards Corp., Cascade's wholly-owned loyalty-program subsidiary, which maintains approximately 41.2 million registered members as of the most recent quarterly report. This data includes loyalty-program enrollment information, points accrual and redemption activity, tier status, promotional offer engagement, and associated demographic data provided by consumers during enrollment.

• Mobile-app behavioral data: Data processed through Peakview Analytics Inc., Cascade's mobile analytics vendor, which processes approximately 2.1 billion consumer-event data records per month. This data includes app-session data, geolocation data (where consumers have granted permission), push-notification engagement, and in-app purchase behavior.

The existing data-sharing arrangement between Cascade and Thornbridge was executed in 2019, prior to the effective date of the CCPA. The 2019 agreement does not contain CCPA-compliant provisions, including but not limited to: (a) contractual restrictions on combining consumer personal information with data from other sources; (b) provisions requiring Thornbridge to honor consumer opt-out requests or signals; (c) adequate purpose-limitation restrictions; (d) audit rights; or (e) data-breach notification provisions meeting current statutory requirements. These deficiencies were identified as critical gaps in both the Fieldhaven Consulting Group LLC data-mapping report dated May 19, 2025 and the C&H gap-analysis report delivered August 15, 2025.

Importantly, the Third-Party Data-Sharing Risk Assessment Memorandum prepared by C&H and dated August 4, 2025 classified Thornbridge as a "third party" under the CCPA, as distinguished from a "service provider" or "contractor." This classification is based on the conclusion that Thornbridge processes Cascade consumer personal information for its own commercial purposes (including audience modeling, cross-client data aggregation, and development of proprietary advertising products) and not solely on behalf of Cascade pursuant to a written contract. As a result, Cascade's transfer of consumer personal information to Thornbridge constitutes a "sale" and/or "sharing" of personal information under CCPA/CPRA, triggering consumer opt-out rights and associated business obligations.

B. Regulatory Drivers

The restructuring of the Thornbridge DSA is driven by a confluence of regulatory requirements and enforcement risks that make the status quo untenable. The principal regulatory drivers are as follows:

Privacy-Policy Deficiencies. Cascade's current online privacy policy was last updated in March 2022 and does not adequately disclose the Thornbridge data-sharing arrangement. The existing policy uses generic language regarding "advertising partners" without specifying the categories of personal information shared, the purposes of sharing, or consumers' rights to opt out. Moreover, the current privacy policy does not address fourteen of the nineteen state privacy statutes now applicable to Cascade's operations. The forthcoming omnibus privacy policy (an initial draft of which was circulated internally on September 12, 2025) will require specific disclosures regarding the Thornbridge relationship, and those disclosures must be supported by contractual provisions in the restructured DSA.

California Attorney General Inquiry. On February 6, 2024, the California Attorney General's Office sent an informal inquiry letter to Cascade, specifically highlighting deficiencies in Cascade's disclosures regarding the sale and sharing of personal information and in Cascade's service-provider and third-party agreements. The Thornbridge relationship was among the data-sharing arrangements implicated by the AG's inquiry. Although the inquiry was informal and did not result in formal enforcement action, it signals heightened regulatory attention to Cascade's data-sharing practices and underscores the urgency of completing the DSA restructuring.

Global Privacy Control Gap. Cascade does not currently honor the Global Privacy Control ("GPC") signal, which is a universal opt-out mechanism recognized under CCPA/CPRA regulations (11 CCR § 7025) and increasingly required under other state privacy statutes. The failure to honor GPC signals is a compliance gap that directly intersects with the Thornbridge data flow: even if Cascade were to begin honoring GPC signals on its own properties, the lack of a contractual mechanism to pass through those signals to Thornbridge would leave a downstream compliance gap. The deployment of a consent management platform by OnPoint Data Solutions Inc. (target deployment date December 15, 2025) is intended to close this gap on the Cascade side, but the Thornbridge DSA must be in place to operationalize GPC signal pass-through on the downstream side.

FTC Scrutiny. The Federal Trade Commission issued a Civil Investigative Demand to Cascade (File No. 232-0147, issued September 14, 2023, and closed April 3, 2024) regarding allegations of dark patterns in Cascade's consumer-facing data practices. Although the CID was ultimately closed without enforcement action, the investigation underscores the ongoing regulatory scrutiny of Cascade's consumer-facing data practices and the importance of ensuring that Cascade's contractual arrangements with data-sharing partners reflect robust consumer-protection standards.

Multi-State Compliance Requirements. In addition to the CCPA/CPRA, Cascade's operations trigger obligations under the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("Colorado CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), and numerous other state privacy statutes. Under these statutes, consumers have the right to opt out of the sale of personal information and/or targeted advertising, and businesses must honor opt-out signals, including GPC where applicable. The restructured DSA must address compliance obligations across all applicable jurisdictions, not only California.

C. Negotiation Procedural History

The negotiation of the restructured DSA has proceeded on the following timeline:

• September 18, 2025: C&H circulated the initial draft DSA to Victor Sandoval at KP&A and to Leah Voss, General Counsel of Thornbridge, via email. The draft consisted of 14 substantive sections plus definitions, schedules, and exhibits, and was accompanied by a cover letter identifying the principal commercial and regulatory objectives underlying the restructuring.

• October 3, 2025: KP&A returned a marked counterproposal to C&H, containing substantive redlines to 14 of the DSA's sections. The counterproposal was accompanied by a brief cover memorandum from Mr. Sandoval identifying Thornbridge's primary concerns and stating Thornbridge's position that several of C&H's proposed provisions exceeded what is legally required for a third-party data-sharing arrangement. The counterproposal is attached to this memorandum as Attachment A (not reproduced herein).

• October 6, 2025: Alan Burke (C&H) and Victor Sandoval (KP&A) held a preliminary review call to identify the major areas of disagreement and to assess the parties' relative flexibility on each issue. During the call, Mr. Sandoval indicated that the combined-data rights issue (Section 4.2) and the indemnification issue (Section 11.2) were of the highest commercial priority to Thornbridge, while the GPC signal issue (Section 7.3) and the audit rights issue (Section 9.1) were primarily operational concerns that Thornbridge believed could be resolved with appropriate transitional provisions.

This memorandum sets forth C&H's analysis of the four principal negotiation issues and the five lower-priority issues, together with recommended positions, for use in the next round of negotiations.

III. Issue 1: Combined-Data Rights (Section 4.2 of Draft DSA)

A. Cascade's Position in Draft

Section 4.2 of C&H's initial draft DSA prohibits Thornbridge from combining Cascade consumer personal information ("PI") with personal information that Thornbridge receives from or on behalf of any other person or entity, or that Thornbridge collects from its own direct interactions with consumers. This restriction is comprehensive in scope and applies to all forms of combination, including data matching, appending, enrichment, co-mingling in shared datasets, and use of Cascade consumer PI as seed data for audience-modeling products.

This restriction was drafted to mirror the combination prohibition set forth in CCPA § 1798.140(j)(1)(A)(iv), which applies to "service providers" and "contractors" under the statute. Although Thornbridge has been classified as a "third party" under the CCPA (and therefore the statutory combination prohibition does not apply directly), Cascade's draft imposes an analogous restriction as a contractual safeguard. The rationale for this approach is threefold:

First, the combination restriction supports Cascade's position that it has implemented reasonable controls over the downstream use of consumer personal information, which is relevant to Cascade's defense posture in the event of any future regulatory inquiry or enforcement action.

Second, the restriction is consistent with the purpose-limitation principles embedded in the VCDPA, Colorado CPA, CTDPA, and other applicable state privacy statutes, which generally require that personal information be processed only for specified, disclosed purposes and not be further processed in a manner incompatible with those purposes.

Third, the restriction reflects Cascade's consumer-facing commitments. The forthcoming omnibus privacy policy will represent to consumers that data shared with advertising partners is used for specified advertising purposes on Cascade's behalf, not for the development of Thornbridge's proprietary data products or for the benefit of Thornbridge's other clients.

B. Thornbridge/KP&A Counterproposal

KP&A's redline deletes the combination prohibition in Section 4.2 entirely and replaces it with a provision that affirmatively permits Thornbridge to combine Cascade consumer data with the following categories of data:

• Thornbridge's proprietary audience segments and behavioral data;

• Third-party data obtained by Thornbridge from data brokers, data aggregators, and other commercial data sources; and

• Data received by Thornbridge from its other advertising clients.

The only safeguard imposed under KP&A's counterproposal is a requirement that Thornbridge de-identify the combined data within 90 days after the date of combination. During the 90-day period, Thornbridge would be free to use the combined data — including identifiable Cascade consumer PI — in its audience-modeling, lookalike-audience, and cross-client advertising products without restriction.

In the cover memorandum accompanying the counterproposal, Mr. Sandoval articulated Thornbridge's commercial rationale for this position: Thornbridge's core value proposition as an advertising platform depends on cross-client data aggregation. Thornbridge's audience-modeling and lookalike-audience products require the ability to analyze and combine behavioral data across its entire client base to identify consumer patterns and build predictive models. Prohibiting combination would, in Thornbridge's view, fundamentally undermine the services for which Cascade pays $18.4 million annually and would reduce the performance of Cascade's own programmatic campaigns.

KP&A also advanced a legal argument in support of the counterproposal: because Thornbridge receives data as a "third party" under the CCPA (not as a service provider or contractor), the combination restriction set forth in CCPA § 1798.140(j)(1)(A)(iv) is not legally mandated. KP&A argued that imposing service-provider-level restrictions on a third-party relationship is legally unnecessary and commercially disproportionate.

C. Legal Risk Assessment

KP&A's legal argument is technically correct as a matter of statutory interpretation: the CCPA does not impose a statutory combination restriction on entities classified as "third parties" in the same manner that it restricts "service providers" and "contractors." The combination prohibition in § 1798.140(j)(1)(A)(iv) is a definitional element of the service-provider classification, and because Thornbridge falls outside that classification, the specific statutory provision does not apply.

However, KP&A's argument does not account for the broader compliance risks and regulatory expectations that inform Cascade's position. Permitting unrestricted combination of Cascade consumer PI with data from other sources creates the following risks:

(a) Regulatory-defense risk. Unrestricted combination undermines Cascade's ability to demonstrate to regulators — including the California Privacy Protection Agency ("CPPA"), state attorneys general, and the FTC — that Cascade has implemented "reasonable" data-governance controls over downstream data use. In the current enforcement environment, regulators have increasingly scrutinized the substance of businesses' contractual controls over third-party data sharing, and the absence of combination restrictions could be characterized as a governance failure.

(b) Consumer-disclosure risk. Permitting unrestricted combination is inconsistent with Cascade's consumer-facing representations. The forthcoming omnibus privacy policy (draft dated September 12, 2025) will represent that personal information shared with advertising partners is used for specified purposes related to Cascade's marketing activities. If Thornbridge is permitted to combine Cascade consumer PI with data from other clients and other sources for Thornbridge's own proprietary products, Cascade's privacy-policy disclosures will be materially incomplete or misleading.

(c) Regulatory-inquiry risk. In the event of any future inquiry by the California Attorney General, the CPPA, or the FTC, the permissive combination provision would likely be viewed unfavorably. The February 2024 informal inquiry from the California AG's Office already flagged deficiencies in Cascade's data-sharing arrangements, and a DSA that affirmatively permits unrestricted data combination would not demonstrate meaningful remediation.

(d) Multi-state compliance risk. The data-minimization and purpose-limitation principles embedded in the Colorado CPA, CTDPA, OCPA, and other state statutes create additional risk. These statutes generally require that personal data processing be limited to what is reasonably necessary for disclosed purposes. Permitting Thornbridge to combine Cascade consumer PI with cross-client data for Thornbridge's proprietary purposes may constitute processing that exceeds the scope of the purposes disclosed to consumers.

Risk rating: High. Unrestricted combination undermines the compliance posture of the entire DSA restructuring and creates enforcement risk across multiple jurisdictions. This issue is the single most significant compliance concern in the KP&A counterproposal.

D. Recommended Negotiation Position

Primary position: Maintain the combination prohibition as drafted in Section 4.2, with a narrow carve-out allowing Thornbridge to combine Cascade consumer PI with Thornbridge's proprietary first-party data solely for the purpose of performing services under the DSA (i.e., Cascade-directed programmatic campaigns). This carve-out would be subject to the following conditions:

(i) The combined data may be used only to perform services directed by Cascade under the DSA and may not be used for the benefit of any other Thornbridge client, for the development of Thornbridge's proprietary data products, or for any purpose not expressly authorized by Cascade in writing;

(ii) Thornbridge must maintain technical and organizational controls to segregate combined datasets from Thornbridge's general-purpose data assets;

(iii) Combined datasets must be subject to the same use restrictions, opt-out obligations, and audit rights applicable to Cascade consumer PI under the DSA; and

(iv) Thornbridge must provide annual written certification from its privacy officer confirming compliance with the combination restrictions.

This carve-out is designed to address Thornbridge's legitimate commercial need to leverage its first-party data assets in performing services for Cascade, while preventing the downstream use of Cascade consumer PI for Thornbridge's proprietary purposes or for the benefit of other Thornbridge clients.

Fallback position: If Thornbridge will not accept the primary position, Cascade may consider permitting combination only in pseudonymized form — not merely de-identified within 90 days as proposed by KP&A, but pseudonymized at the point of combination using industry-standard pseudonymization techniques. This fallback would be subject to the following additional conditions:

(a) A contractual prohibition on re-identification of the pseudonymized data, with technical controls to prevent re-identification;

(b) A contractual commitment that combined datasets are not used to target, profile, or serve advertising to Cascade consumers on behalf of any third party;

(c) Annual certification from Thornbridge's privacy officer confirming compliance with the combination and pseudonymization requirements; and

(d) Cascade audit rights over the combination environment, including the right to verify that pseudonymization has been properly implemented and that re-identification controls are effective.

Red line (non-negotiable): Cascade should not agree to unrestricted combination with de-identification on a 90-day lag, as proposed in the KP&A counterproposal. The 90-day window creates an extended open period during which identifiable Cascade consumer personal information is used in combined form without adequate safeguards. This approach is inconsistent with Cascade's compliance objectives and creates unacceptable regulatory risk. This position should be communicated clearly to KP&A at the outset of the next negotiation session to avoid protracted discussions on a formulation that Cascade cannot accept.

IV. Issue 2: Real-Time GPC Signal Pass-Through (Section 7.3 of Draft DSA)

A. Cascade's Position in Draft

Section 7.3 of C&H's initial draft DSA requires Thornbridge to honor Global Privacy Control ("GPC") signals passed through by Cascade in real time — that is, at the time of each ad request or data transmission. Under this provision, when a consumer has enabled GPC in their browser or device settings, Cascade will include a GPC flag in its data transmissions to Thornbridge, and Thornbridge must suppress the sale and/or sharing of that consumer's personal information immediately upon receipt of the GPC signal. The suppression obligation applies to all downstream processing by Thornbridge, including programmatic ad targeting, audience modeling, and data combination (to the extent combination is permitted under Section 4.2).

This provision is designed to close a critical compliance gap identified in the C&H gap-analysis report: Cascade currently does not honor GPC signals, and no downstream mechanism exists to transmit opt-out preferences to Thornbridge or other data-sharing partners. The deployment of a consent management platform ("CMP") by OnPoint Data Solutions Inc. is targeted for December 15, 2025. The OnPoint CMP will enable real-time GPC detection at the point of consumer interaction with Cascade's digital properties and will generate API-level opt-out signals that can be transmitted to downstream data recipients. The restructured Thornbridge DSA must be in place to operationalize this downstream signal pass-through.

The real-time processing requirement reflects the regulatory expectation that opt-out preferences be honored promptly and that no processing inconsistent with the consumer's opt-out election occur after the signal has been transmitted. This expectation is grounded in the CCPA/CPRA regulations, California AG/CPPA guidance, and analogous provisions of the Colorado CPA, CTDPA, and other state statutes.

B. Thornbridge/KP&A Counterproposal

KP&A's redline modifies Section 7.3 to substitute batch processing for real-time processing. Under the counterproposal, Thornbridge would process opt-out signals on a weekly batch basis, updated every Sunday at midnight Pacific Time, rather than in real time at the point of each data transmission.

Thornbridge's stated rationale for this position, as articulated by Mr. Sandoval during the October 6, 2025 preliminary review call, is twofold:

First, Thornbridge's existing ad-serving infrastructure is not currently configured to process per-impression opt-out signals. Thornbridge's platform operates on a pre-built audience-segment model in which consumer data is processed and segmented in advance of ad-serving events, and audience segments are refreshed on a periodic (currently weekly) cycle. Introducing real-time, per-impression opt-out processing would require significant re-engineering of Thornbridge's data pipeline and ad-serving architecture.

Second, Thornbridge asserts that real-time opt-out processing would degrade the performance of its ad-targeting algorithms by introducing latency into the ad-serving process. Thornbridge contends that the incremental compliance benefit of real-time processing (as compared to weekly batch processing) does not justify the engineering cost and performance degradation.

As an alternative to real-time processing, KP&A's counterproposal includes a 6-month implementation runway. Under this alternative, Thornbridge would have until April 30, 2026 to build real-time GPC processing capability, with weekly batch processing serving as an interim measure during the implementation period.

C. Legal Risk Assessment

The legal risk associated with KP&A's weekly-batch-processing proposal is significant and, in C&H's assessment, renders the proposal indefensible under current CCPA/CPRA regulations.

CCPA/CPRA regulations at 11 CCR § 7025 require businesses to treat the GPC signal as a valid request to opt out of the sale and sharing of personal information. The regulations further require that businesses process opt-out requests and cease the sale or sharing of personal information "as soon as commercially reasonable" and, in the case of online interactions, generally before the next interaction with the consumer. Weekly batch processing creates a window of up to seven days during which a consumer who has enabled GPC continues to have their personal information sold or shared by Thornbridge, notwithstanding the consumer's clearly expressed opt-out preference. This delay is inconsistent with the "as soon as commercially reasonable" standard and would expose Cascade to enforcement risk in the event of a CPPA or California AG investigation.

The risk is amplified by the scale of the data involved. Given that Thornbridge processes data associated with approximately 41.2 million Cascade Rewards members and approximately 2.1 billion consumer-event data records per month, a seven-day lag in opt-out processing could affect millions of consumer interactions per processing cycle.

The Colorado CPA and Connecticut CTDPA also require businesses to honor universal opt-out mechanisms, with similar expectations regarding timeliness of implementation. To the extent consumers in those jurisdictions enable GPC or equivalent signals, Cascade's obligations extend beyond California.

Risk rating: High. Weekly batch processing is not legally defensible under current CCPA/CPRA regulations and creates substantial enforcement risk for Cascade. The 6-month implementation runway proposed by KP&A would extend the period of non-compliance well beyond the Phase 1 milestone date and into the period during which the OnPoint CMP will be operational, creating a mismatch between Cascade's consumer-facing compliance posture and its actual downstream data practices.

D. Recommended Negotiation Position

Primary position: Maintain the real-time GPC signal pass-through requirement as drafted in Section 7.3. Cascade's CMP deployment (OnPoint Data Solutions Inc., target deployment December 15, 2025) is being designed to transmit GPC signals at the API level in real time. The Thornbridge DSA should require Thornbridge to match this capability so that the end-to-end system — from consumer signal to downstream data suppression — operates in real time without compliance gaps.

Fallback position: C&H recognizes that Thornbridge may require a limited transition period to build the necessary technical infrastructure. If Thornbridge cannot commit to real-time processing at DSA execution, Cascade may accept a transition period subject to the following conditions:

(i) The transition period must not exceed 60 days from the date of DSA execution — i.e., approximately December 31, 2025, aligning with the Phase 1 completion date. A 6-month runway to April 30, 2026, as proposed by KP&A, is excessive and unacceptable.

(ii) During the transition period, Thornbridge must process batch opt-outs on a daily basis (not weekly). Daily batch processing reduces the compliance gap from seven days to approximately 24 hours, which, while not ideal, is significantly more defensible than weekly processing.

(iii) After the expiration of the transition period, real-time processing is mandatory. The DSA should include a contractual milestone requiring Thornbridge to demonstrate real-time GPC processing capability no later than the end of the transition period, with Cascade having the right to conduct a technical review or audit to verify implementation.

Additional safeguard: Regardless of the agreed-upon transition timeline, C&H recommends that Cascade require Thornbridge to implement a "suppression by default" rule during the transition period. Under this rule, if Thornbridge cannot affirmatively confirm opt-in status for a consumer located in California, Colorado, or Connecticut at the time of an ad request, Thornbridge must suppress the sale and sharing of that consumer's personal information. This approach shifts the default from "process unless opt-out is confirmed" to "suppress unless opt-in is confirmed," which is a significantly more conservative and defensible posture during the transition period. While this approach may result in some over-suppression and a temporary reduction in ad-targeting performance, it protects Cascade against the risk of processing consumer data in violation of opt-out preferences during the transition.

Red line (non-negotiable): Weekly batch processing is unacceptable under any circumstance, whether as an interim measure or otherwise. Any agreed-upon transition period must be strictly time-limited, must include daily (not weekly) batch processing as the minimum interim measure, and must terminate in a binding obligation to implement real-time processing. Cascade cannot accept an open-ended or indefinite transition to real-time processing.

V. Issue 3: Audit Rights (Section 9.1 of Draft DSA)

A. Cascade's Position in Draft

Section 9.1 of C&H's initial draft DSA grants Cascade, or a third-party auditor designated by Cascade, the right to audit Thornbridge's data-processing practices, facilities, and records for compliance with the DSA. The audit right is exercisable upon 30 days' written notice and may be exercised up to two times per calendar year.

The scope of the audit right, as drafted, encompasses the following:

• Inspection of data systems, servers, and storage environments in which Cascade consumer PI is processed or maintained;

• Interviews with relevant Thornbridge personnel involved in data processing, including engineering, data-science, and privacy/compliance staff;

• Review of technical and organizational security measures implemented by Thornbridge to protect Cascade consumer PI;

• Verification of compliance with the data-combination restrictions set forth in Section 4.2 (Issue 1 above);

• Verification of compliance with the GPC signal-processing requirements set forth in Section 7.3 (Issue 2 above);

• Review of data-retention and deletion practices; and

• Review of incident-response and breach-notification procedures.

Audit rights are required contractual provisions under CCPA/CPRA for service-provider and contractor agreements. Although the statutory audit requirement does not apply directly to third-party arrangements, the inclusion of audit rights in a third-party DSA is a recognized best practice and is necessary for Cascade to verify ongoing compliance with the contractual safeguards that substitute for the statutory protections that would otherwise apply in a service-provider relationship. Audit rights are also mandated by the VCDPA, Colorado CPA, CTDPA, and other state privacy statutes for data-processing agreements, and while these mandates technically apply to "processor" (rather than "third-party") relationships, the inclusion of audit rights in the Thornbridge DSA strengthens Cascade's overall compliance posture.

B. Thornbridge/KP&A Counterproposal

KP&A's redline modifies Section 9.1 in several material respects:

(a) Frequency reduction. KP&A reduces the audit frequency from twice per calendar year to once per calendar year.

(b) Duration limitation. KP&A imposes a maximum audit duration of 3 business days, regardless of the scope or complexity of the audit.

(c) Auditor-selection restriction. KP&A requires that audits be conducted by a mutually agreed independent auditor. Cascade would not be permitted to use its internal audit team or to unilaterally select a third-party auditor. This provision effectively gives Thornbridge veto power over auditor selection.

(d) SOC 2 substitution. KP&A provides that Thornbridge may satisfy its audit obligations by providing an annual SOC 2 Type II report, or equivalent third-party certification, in lieu of permitting an on-site audit.

(e) Cost allocation. KP&A provides that Cascade bears the full cost of any audit conducted under Section 9.1.

Thornbridge's stated rationale for these modifications, as conveyed by Mr. Sandoval, relates to audit disruption, cost burden, and the protection of Thornbridge's proprietary ad-tech algorithms and trade secrets. Mr. Sandoval emphasized that Thornbridge's platform incorporates proprietary machine-learning models and algorithmic processes that constitute core trade secrets, and that unrestricted audit access could expose these proprietary assets to Cascade or its auditors.

C. Legal Risk Assessment

The risk profile of the KP&A audit provisions varies by subissue:

Frequency. Reducing to once per calendar year is not per se legally non-compliant. No applicable statute mandates a specific audit frequency for third-party data-sharing relationships. However, once-per-year auditing limits Cascade's ability to verify ongoing compliance during the initial implementation period — precisely the period during which compliance risks are highest as new contractual provisions (combination restrictions, GPC processing, opt-out handling) are being operationalized for the first time.

SOC 2 substitution. The SOC 2 Type II substitution provision is the most concerning element of KP&A's counterproposal on this issue. A standard SOC 2 Type II report is designed around the American Institute of CPAs' trust-service criteria (security, availability, processing integrity, confidentiality, and privacy) and evaluates whether an organization's controls are suitably designed and operating effectively over a specified review period. However, a SOC 2 report is not designed to assess compliance with the specific contractual obligations in the DSA — including combination prohibitions, GPC signal handling, purpose-limitation restrictions, and data-retention requirements. A SOC 2 report may confirm that Thornbridge maintains adequate security controls in a general sense while providing no assurance whatsoever regarding Thornbridge's compliance with the substantive data-use restrictions in the DSA.

Auditor selection. The mutual-agreement requirement for auditor selection is problematic because it could function as a de facto veto right. If Thornbridge refuses to agree on an auditor proposed by Cascade, the audit mechanism is effectively neutralized. This risk is particularly acute in scenarios where Cascade suspects non-compliance and seeks an audit on an expedited basis — the mutual-agreement requirement could create delays that undermine the audit's effectiveness.

Cost allocation. The cost-allocation provision is not inherently unreasonable, but it should be qualified: if an audit reveals material non-compliance, Thornbridge — not Cascade — should bear the audit costs.

Risk rating: Medium. Once-per-year audit frequency is workable with appropriate supplemental protections, but the SOC 2 substitution provision and the mutual-agreement auditor-selection requirement, taken together, could effectively eliminate Cascade's ability to conduct meaningful compliance verification. These provisions must be modified.

D. Recommended Negotiation Position

Primary position: Maintain the twice-per-year audit right for the first two years of the DSA term, covering the critical implementation and ramp-up period during which new contractual obligations are being operationalized. After the initial two-year period, the audit frequency would reduce to once per calendar year. Cascade would retain the right to select its auditor unilaterally, subject to the auditor's execution of a reasonable confidentiality agreement with Thornbridge to protect Thornbridge's proprietary information.

Fallback position: If Thornbridge will not accept twice-per-year auditing, Cascade may accept once per calendar year as the baseline audit frequency, subject to the following conditions:

(a) For-cause audit right. In addition to the scheduled annual audit, Cascade retains the right to conduct an additional "for cause" audit at any time, triggered by any of the following events: (i) a suspected or confirmed breach of the DSA by Thornbridge; (ii) a regulatory inquiry, investigation, or enforcement action by any governmental authority relating to Thornbridge's processing of Cascade consumer PI; (iii) a consumer complaint received by Cascade relating to Thornbridge's data processing; or (iv) a material change in Thornbridge's data-processing practices, infrastructure, or personnel. For-cause audit rights are not subject to frequency limitations.

(b) SOC 2 as supplemental evidence. SOC 2 Type II reports, or equivalent third-party certifications, are acceptable as supplemental evidence of Thornbridge's general security posture. However, SOC 2 reports do not satisfy the audit obligation and cannot substitute for a DSA-specific audit. Cascade must retain the right to conduct an on-site or remote audit focused specifically on Thornbridge's compliance with the substantive provisions of the DSA, including combination restrictions, GPC signal processing, purpose limitations, and data-retention requirements.

(c) Unilateral auditor selection. Cascade may designate its auditor unilaterally, without requiring Thornbridge's agreement. However, the designated auditor must execute Thornbridge's standard form of non-disclosure agreement prior to the commencement of the audit. Cascade will not agree to a bespoke or custom NDA negotiation process for each audit, as this could be used to delay or obstruct audits. Thornbridge's standard NDA, applied without modification, is the appropriate mechanism.

(d) Cost allocation. Audit costs are borne by Cascade as the requesting party, unless the audit reveals a material breach of the DSA by Thornbridge, in which case Thornbridge bears the full costs of the audit.

Concession available: C&H recommends that Cascade offer the following concessions to facilitate agreement on this issue:

(i) Duration cap. Agree to a maximum audit duration of 5 business days (rather than the unlimited duration implied by C&H's draft or the 3-business-day cap proposed by KP&A). Five business days provides sufficient time for a meaningful audit of DSA-specific obligations while addressing Thornbridge's concerns about operational disruption.

(ii) Trade-secret protections. Agree that auditors may review Thornbridge's data practices, technical and organizational controls, data flows, and processing logs without requiring access to Thornbridge's proprietary algorithmic source code or machine-learning model architecture. This concession addresses Thornbridge's legitimate trade-secret concerns without impairing the audit's ability to verify compliance with the DSA's substantive provisions.

Red line (non-negotiable): Cascade must retain the right to select its auditor unilaterally, subject only to the auditor's execution of Thornbridge's standard NDA. A mutual-agreement requirement that gives Thornbridge veto power over auditor selection is unacceptable. Additionally, SOC 2 Type II reports cannot fully substitute for a DSA-specific audit. These two points are essential to preserving the integrity and functionality of the audit mechanism.

VI. Issue 4: Indemnification Scope for Regulatory Fines (Section 11.2 of Draft DSA)

A. Cascade's Position in Draft

Section 11.2 of C&H's initial draft DSA provides that Thornbridge will indemnify, defend, and hold harmless Cascade and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, fines, penalties, enforcement costs, attorneys' fees, and expenses arising from or relating to:

(a) Thornbridge's breach of any provision of the DSA; or

(b) Thornbridge's violation of any applicable privacy law, data-protection statute, or regulation in connection with Thornbridge's processing of Cascade consumer personal information.

The indemnification obligation expressly covers regulatory fines, penalties, or assessments imposed by the California Privacy Protection Agency ("CPPA"), any state attorney general, the Federal Trade Commission, or any other governmental authority. The coverage extends to both compensatory and non-compensatory regulatory assessments, including civil penalties, statutory fines, and consent-decree monetary obligations.

Cascade's draft does not include a cap on the aggregate amount of indemnification. This reflects Cascade's view that the indemnification obligation should be commensurate with the magnitude of the potential regulatory exposure, particularly given the scale of the data involved and the per-violation penalty structure of the CCPA and other applicable statutes.

B. Thornbridge/KP&A Counterproposal

KP&A's redline modifies Section 11.2 to limit Thornbridge's indemnification obligation in the following respects:

(a) Exclusion of regulatory fines and penalties. KP&A's primary position is that regulatory fines and penalties should be excluded entirely from the scope of Thornbridge's indemnification obligation. Under this formulation, Thornbridge would indemnify Cascade only for direct damages, including costs of defense and settlement of private claims brought by consumers or other private parties, but would bear no responsibility for regulatory fines or penalties, regardless of whether such fines or penalties are attributable to Thornbridge's breach of the DSA or Thornbridge's violation of applicable law.

(b) Alternative indemnification cap. As an alternative to the complete exclusion of fines, KP&A proposes that, if regulatory fines and penalties are included within the scope of indemnification, Thornbridge's aggregate indemnification obligation be capped at an amount equal to the fees paid by Cascade to Thornbridge in the twelve months preceding the date of the claim giving rise to the indemnification obligation. Based on Cascade's FY2024 spend, this cap would be approximately $18.4 million.

(c) Mutual-fault carve-out. KP&A's redline includes a carve-out providing that Thornbridge's indemnification obligation does not extend to fines, penalties, or damages that are attributable, in whole or in part, to Cascade's own acts or omissions — for example, Cascade's failure to properly transmit opt-out signals to Thornbridge, Cascade's failure to make adequate consumer disclosures, or other compliance failures on the Cascade side of the data flow.

In support of the exclusion of regulatory fines, KP&A cites public-policy arguments. Specifically, KP&A contends that contractual indemnification for regulatory fines and penalties may be unenforceable in certain jurisdictions on the ground that indemnification would shift the punitive impact of the fine away from the party whose conduct the regulator intended to sanction, thereby undermining the deterrent purpose of the fine. KP&A further argues that imposing uncapped indemnification for regulatory fines is commercially unreasonable given the volume of data processed and the magnitude of potential per-violation penalties under the CCPA.

C. Legal Risk Assessment

KP&A's public-policy argument regarding the enforceability of fine-indemnification provisions has some analytical merit but is unlikely to prevail as a general matter. The enforceability of contractual indemnification for regulatory fines and penalties varies by jurisdiction:

• Some jurisdictions have held that contractual indemnification for punitive damages or government-imposed penalties is against public policy, on the theory that allowing indemnification defeats the deterrent purpose of the penalty.

• However, the majority position among courts addressing this issue — particularly in commercial disputes between sophisticated parties — permits contractual allocation of regulatory fines between the parties, particularly where the indemnifying party's conduct was the proximate cause of the fine. This is especially true where, as here, the indemnification provision allocates responsibility to the party whose breach or non-compliance triggered the regulatory action.

• Delaware law (which C&H has proposed as the governing law for the DSA) generally enforces contractual indemnification provisions as written between sophisticated commercial parties, including provisions covering regulatory fines and penalties, subject to the usual limitations on indemnification for a party's own willful misconduct.

The aggregate cap proposed by KP&A (trailing 12-month fees, approximately $18.4 million) is within market range for data-sharing agreements of comparable scale. However, it is lower than Cascade's potential regulatory exposure. Under the CCPA, statutory penalties range from $2,500 per unintentional violation to $7,500 per intentional violation. Given the scale of Cascade's data operations — approximately 94 million annual online transactions, approximately 41.2 million loyalty-program members, and approximately 2.1 billion monthly consumer-event data records flowing through Peakview Analytics — the theoretical per-violation penalty exposure is substantial. While regulators have not historically imposed penalties at the full theoretical maximum, the potential exposure significantly exceeds the $18.4 million cap proposed by KP&A.

Cascade's own cyber and privacy-liability insurance, underwritten by Northcastle Indemnity Company, provides $25 million per occurrence and $50 million in annual aggregate coverage (policy period July 1, 2025 through June 30, 2026, with an annual premium of $1,340,000). While the insurance program provides a backstop, Cascade should not rely on insurance coverage as a substitute for contractual risk allocation with Thornbridge. Insurance coverage is subject to policy exclusions, deductibles, and coverage disputes, and Cascade's premium costs would likely increase in the event of a claim, regardless of whether Thornbridge bears contractual responsibility.

The mutual-fault carve-out proposed by KP&A (item (c) above) is reasonable and appropriate. Cascade should not seek indemnification from Thornbridge for fines or penalties that are attributable to Cascade's own compliance failures — for example, Cascade's failure to properly configure its CMP to detect and transmit GPC signals, or Cascade's failure to make adequate consumer disclosures in its privacy policy. Including a proportional-fault allocation mechanism for mixed-fault scenarios would be appropriate and consistent with equitable principles.

Risk rating: Medium-High. The total exclusion of regulatory fines from indemnification is unacceptable and would leave Cascade bearing the full financial impact of fines caused by Thornbridge's non-compliance. A reasonable cap with appropriate conditions is negotiable, but the cap must be set at a level commensurate with the risk profile.

D. Recommended Negotiation Position

Primary position: Maintain the indemnification provision as drafted, covering regulatory fines and penalties without an aggregate cap, where the fine or penalty arises from Thornbridge's breach of the DSA or Thornbridge's independent violation of applicable law in connection with its processing of Cascade consumer PI. C&H's view is that Thornbridge, as the party whose conduct triggers the regulatory action, should bear the financial consequences without an arbitrary cap, particularly where the indemnification obligation is limited to fines caused by Thornbridge's own breach or non-compliance.

Fallback position: If Thornbridge insists on an aggregate cap, Cascade should accept a cap set at 2x the trailing 12-month fees paid by Cascade to Thornbridge (i.e., approximately $36.8 million based on current spend levels). A 2x multiplier is more consistent with the risk profile of the arrangement, given the scale of data processing and Cascade's potential regulatory exposure, and is within the range of caps observed in comparable data-sharing agreements for enterprises of similar scale. Regulatory fines and penalties must remain within the scope of the capped indemnification — any formulation that excludes fines entirely, even within a cap, is not acceptable.

Alternative fallback: If Thornbridge will not accept a 2x cap, Cascade may consider a cap of 1.5x the trailing 12-month fees (i.e., approximately $27.6 million based on current spend). C&H recommends that 1.5x be treated as the absolute floor for this negotiation. A cap lower than 1x trailing 12-month fees ($18.4 million) is not recommended, as it would effectively cap Cascade's recovery at an amount that may be insufficient to cover even a moderate regulatory fine in the CCPA context.

Accepted concession: The mutual-fault carve-out proposed by KP&A is reasonable and should be accepted. Cascade should not seek indemnification from Thornbridge for fines, penalties, or damages that are attributable to Cascade's own acts or omissions, including:

• Cascade's failure to properly configure, deploy, or maintain the OnPoint CMP or to transmit opt-out signals to Thornbridge in accordance with the DSA's technical specifications;

• Cascade's failure to make adequate disclosures in its consumer-facing privacy policy;

• Cascade's failure to respond to consumer rights requests directed to Cascade; or

• Any other compliance failure on the Cascade side of the data flow.

For scenarios involving mixed fault — i.e., where both Cascade's and Thornbridge's conduct contributed to the regulatory fine — C&H recommends including a proportional-fault allocation mechanism. Under this mechanism, Thornbridge's indemnification obligation would be reduced in proportion to the degree to which Cascade's own acts or omissions contributed to the fine. The proportional-fault determination would be made by mutual agreement of the parties or, in the event of a dispute, by the dispute-resolution mechanism set forth in the DSA.

Red line (non-negotiable): Regulatory fines and penalties must remain within the scope of Thornbridge's indemnification obligation. The total exclusion of fines from indemnification — as proposed in KP&A's primary position — is unacceptable under any circumstances. A DSA that does not require Thornbridge to bear financial responsibility for fines caused by its own non-compliance fails to achieve one of the core risk-allocation objectives of the restructuring.

VII. Additional Redline Issues (Lower Priority)

In addition to the four principal issues analyzed above, KP&A's counterproposal includes redlines to several additional DSA provisions. C&H's analysis and recommended positions on these lower-priority issues are set forth below. None of these issues presents a compliance risk comparable to Issues 1 through 4, and each is amenable to a reasonable compromise.

A. Definition of "Personal Information" (Section 1.1)

KP&A's redline narrows the definition of "Personal Information" in Section 1.1 to exclude de-identified data and aggregated data from the scope of the term. Upon review, C&H's initial draft already excludes de-identified and aggregated data from the definition, consistent with the exclusions set forth in CCPA § 1798.140(v). Accordingly, there is no substantive disagreement between the parties on this point. C&H recommends confirming alignment with KP&A on the precise definitional language to ensure consistency with the CCPA statutory definitions and to avoid any ambiguity regarding the treatment of pseudonymized data (which remains within the scope of "Personal Information" under the CCPA, unlike de-identified data).

B. Data Deletion / Return on Termination (Section 12.3)

KP&A's redline requests a 90-day post-termination retention period for Cascade consumer PI, during which Thornbridge would be permitted to retain the data for purposes of winding down any active campaigns and completing any contractually required reporting. C&H's draft requires deletion or return of all Cascade consumer PI within 30 days of termination or expiration of the DSA.

C&H recommends accepting a 60-day compromise as the post-termination retention period. Sixty days provides Thornbridge with reasonable time to wind down active campaigns and complete reporting obligations, while limiting the period during which Cascade consumer PI remains in Thornbridge's possession after the contractual relationship has ended. The 60-day period should be conditioned on the following requirements:

(i) Thornbridge must certify in writing, within 10 business days after the expiration of the 60-day period, that all Cascade consumer PI has been deleted from Thornbridge's systems, including backup and disaster-recovery systems, or returned to Cascade in a format reasonably specified by Cascade.

(ii) During the 60-day retention period, Thornbridge's processing of Cascade consumer PI must be limited strictly to wind-down and reporting purposes; no new campaigns, audience modeling, or data combination may be initiated using Cascade consumer PI during this period.

(iii) All substantive provisions of the DSA (including combination restrictions, opt-out obligations, and security requirements) remain in full force and effect during the 60-day retention period.

C. Breach Notification Timeline (Section 10.2)

KP&A's redline proposes a 72-hour breach notification timeline — i.e., Thornbridge would be required to notify Cascade of any data breach or security incident involving Cascade consumer PI within 72 hours of discovery. C&H's draft requires notification within 48 hours of discovery.

C&H recommends maintaining the 48-hour notification timeline. Cascade's obligation to notify regulators and affected consumers under certain state data-breach notification statutes is typically triggered within 72 hours of the business's discovery of the breach. If Thornbridge is permitted 72 hours to notify Cascade, and Cascade then requires additional time to assess the incident and prepare its own notifications, Cascade may be unable to meet its downstream notification obligations within the applicable statutory timeframes. A 48-hour notification timeline from Thornbridge to Cascade preserves Cascade's ability to conduct its own assessment and meet 72-hour (or shorter) notification windows under applicable state laws.

C&H acknowledges that 48-hour notification may require Thornbridge to provide preliminary or incomplete information in its initial notification. The DSA should clarify that the 48-hour notification obligation requires Thornbridge to provide all information reasonably available at the time of notification, with supplemental information to follow as the investigation progresses. This formulation addresses Thornbridge's likely concern that a compressed notification timeline may result in inaccurate or incomplete initial reports.

D. Governing Law and Dispute Resolution (Section 14)

KP&A's redline proposes Nevada law as the governing law for the DSA, reflecting Thornbridge's state of incorporation. C&H's draft specifies Washington law (the state in which Cascade is headquartered) or, alternatively, Delaware law (Cascade's state of incorporation).

C&H recommends insisting on Delaware law. Delaware offers a neutral forum with well-developed commercial law, a sophisticated judiciary experienced in complex commercial disputes, and predictable case law regarding the enforcement of contractual provisions, including indemnification, limitation-of-liability, and dispute-resolution clauses. Delaware law is consistent with the governing-law provisions in Cascade's other major commercial agreements, which promotes uniformity in Cascade's contract portfolio and reduces the complexity of managing legal obligations across multiple governing-law regimes.

Nevada law is not objectionable on substantive grounds, but Delaware law is preferable for the reasons stated above, and C&H believes KP&A will accept Delaware as a reasonable compromise between the parties' respective home-state preferences.

If KP&A resists Delaware law and agreement on governing law becomes an impediment to closing, C&H recommends offering to accept

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
INTERNAL MEMORANDUM
CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, New York 10022
Matter Number: 1038-00010
To: Kevin Ostrowski, Partner, Privacy & Data Security
From: Alan Burke, Senior Associate, Privacy & Data Security
Date: October 8, 2025
Re: Thornbridge Media Corp. — Negotiation Issues List and Redline Commentary on Counterproposal to Restructured Data-Sharing Agreement
PRIVILEGE LEGEND: This memorandum is a privileged and confidential attorney work-product communication prepared in connection with Calderwood & Harkness LLP's representation of Cascade Retail Holdings Inc. ("Cascade" or the "Client"). It is not intended for disclosure to third parties and should not be forwarded or produced without prior approval of counsel. This memorandum reflects the mental impressions, conclusions, opinions, and legal theories of counsel and is protected from disclosure under Federal Rule of Civil Procedure 26(b)(3), the attorney-client privilege, and applicable state-law equivalents.
I. Executive Summary
The purpose of this memorandum is to analyze the counterproposal received on October 3, 2025 from Victor Sandoval of Kellner Park & Associates LLP ("KP&A"), located at 555 Mission Street, 32nd Floor, San Francisco, California 94105, on behalf of Thornbridge Media Corp. ("Thornbridge"), in response to the restructured Data-Sharing Agreement ("DSA") that Calderwood & Harkness LLP ("C&H") circulated on behalf of Cascade Retail Holdings Inc. ("Cascade") on September 18, 2025.
Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner. Cascade's fiscal year 2024 spend with Thornbridge was approximately $18.4 million, making this one of Cascade's most commercially significant data-sharing relationships. Thornbridge is a Nevada corporation headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117. Its Chief Executive Officer is Robert Shin and its General Counsel is Leah Voss.
The DSA restructuring is a critical workstream within Cascade's broader privacy-compliance remediation program. This workstream was initiated following the gap-analysis report delivered by C&H on August 15, 2025, which identified the Thornbridge relationship as the highest-priority data-sharing arrangement requiring restructuring for compliance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and eighteen additional applicable state privacy statutes. The target execution date for the restructured DSA is October 31, 2025, consistent with the Phase 1 milestone schedule established in the remediation program timeline.
Following a comprehensive review of the KP&A counterproposal, C&H has identified four principal negotiation issues that require Client attention and strategic decision-making. Each issue is analyzed below with a description of the C&H position as set forth in the initial draft, the Thornbridge/KP&A position as reflected in the counterproposal redline, a legal risk assessment, and a recommended negotiation strategy including primary positions, fallback positions, and non-negotiable "red lines." The four principal issues are:
1.  Combined-Data Rights (Section 4.2 of the Draft DSA) — Thornbridge's proposal to delete the combination prohibition and replace it with a permissive combination right, subject only to de-identification within 90 days.
2.  Real-Time GPC Signal Pass-Through (Section 7.3 of the Draft DSA) — Thornbridge's proposal to substitute weekly batch processing for real-time Global Privacy Control signal suppression.
3.  Audit Rights (Section 9.1 of the Draft DSA) — Thornbridge's proposal to reduce audit frequency, limit audit duration, require mutual agreement on auditor selection, and permit SOC 2 Type II report substitution.
4.  Indemnification Scope for Regulatory Fines (Section 11.2 of the Draft DSA) — Thornbridge's proposal to exclude regulatory fines and penalties from indemnification, or alternatively to impose a trailing 12-month fee cap.
In addition, this memorandum addresses five lower-priority redline issues raised by KP&A, for which C&H recommends compromise positions that do not materially affect Cascade's compliance posture.
Recommendation: Before the next negotiation session, C&H recommends scheduling a call with Diana Polk (Associate General Counsel and Interim Chief Privacy Officer, Cascade) and Jason Leclaire (Vice President, Marketing & Customer Engagement, Cascade) to confirm Cascade's commercial parameters and risk tolerance on each of the four principal issues. In particular, Mr. Leclaire's input will be essential to calibrate the commercial impact of the combined-data restriction (Issue 1) on Cascade's programmatic-advertising performance and to ensure that Cascade's negotiation positions reflect an informed understanding of the business tradeoffs involved.
II. Background
A. Relationship Overview
Thornbridge Media Corp. is a programmatic-advertising and audience-targeting platform that processes consumer behavioral data received from Cascade. The Thornbridge relationship is one of Cascade's longest-standing advertising partnerships, predating many of the state privacy statutes that now govern the underlying data flows. Thornbridge provides Cascade with audience-modeling, lookalike-audience creation, programmatic ad buying, and cross-channel campaign optimization services. These services are integral to Cascade's digital-marketing operations, and as noted above, Cascade's FY2024 spend with Thornbridge was approximately $18.4 million.
The data flows between Cascade and Thornbridge are extensive and multifaceted. They include the following categories of consumer data:
•  Consumer browsing activity: Data regarding consumers' interactions with Cascade's e-commerce properties, including page views, product searches, time-on-page metrics, and click-through behavior.
•  Purchase history: Transaction-level data, including items purchased, purchase amounts, dates of purchase, payment method categories, and associated product-category codes.
•  Loyalty-program engagement data: Data from Cascade Rewards Corp., Cascade's wholly-owned loyalty-program subsidiary, which maintains approximately 41.2 million registered members as of the most recent quarterly report. This data includes loyalty-program enrollment information, points accrual and redemption activity, tier status, promotional offer engagement, and associated demographic data provided by consumers during enrollment.
•  Mobile-app behavioral data: Data processed through Peakview Analytics Inc., Cascade's mobile analytics vendor, which processes approximately 2.1 billion consumer-event data records per month. This data includes app-session data, geolocation data (where consumers have granted permission), push-notification engagement, and in-app purchase behavior.
The existing data-sharing arrangement between Cascade and Thornbridge was executed in 2019, prior to the effective date of the CCPA. The 2019 agreement does not contain CCPA-compliant provisions, including but not limited to: (a) contractual restrictions on combining consumer personal information with data from other sources; (b) provisions requiring Thornbridge to honor consumer opt-out requests or signals; (c) adequate purpose-limitation restrictions; (d) audit rights; or (e) data-breach notification provisions meeting current statutory requirements. These deficiencies were identified as critical gaps in both the Fieldhaven Consulting Group LLC data-mapping report dated May 19, 2025 and the C&H gap-analysis report delivered August 15, 2025.
Importantly, the Third-Party Data-Sharing Risk Assessment Memorandum prepared by C&H and dated August 4, 2025 classified Thornbridge as a "third party" under the CCPA, as distinguished from a "service provider" or "contractor." This classification is based on the conclusion that Thornbridge processes Cascade consumer personal information for its own commercial purposes (including audience modeling, cross-client data aggregation, and development of proprietary advertising products) and not solely on behalf of Cascade pursuant to a written contract. As a result, Cascade's transfer of consumer personal information to Thornbridge constitutes a "sale" and/or "sharing" of personal information under CCPA/CPRA, triggering consumer opt-out rights and associated business obligations.
B. Regulatory Drivers
The restructuring of the Thornbridge DSA is driven by a confluence of regulatory requirements and enforcement risks that make the status quo untenable. The principal regulatory drivers are as follows:
Privacy-Policy Deficiencies. Cascade's current online privacy policy was last updated in March 2022 and does not adequately disclose the Thornbridge data-sharing arrangement. The existing policy uses generic language regarding "advertising partners" without specifying the categories of personal information shared, the purposes of sharing, or consumers' rights to opt out. Moreover, the current privacy policy does not address fourteen of the nineteen state privacy statutes now applicable to Cascade's operations. The forthcoming omnibus privacy policy (an initial draft of which was circulated internally on September 12, 2025) will require specific disclosures regarding the Thornbridge relationship, and those disclosures must be supported by contractual provisions in the restructured DSA.
California Attorney General Inquiry. On February 6, 2024, the California Attorney General's Office sent an informal inquiry letter to Cascade, specifically highlighting deficiencies in Cascade's disclosures regarding the sale and sharing of personal information and in Cascade's service-provider and third-party agreements. The Thornbridge relationship was among the data-sharing arrangements implicated by the AG's inquiry. Although the inquiry was informal and did not result in formal enforcement action, it signals heightened regulatory attention to Cascade's data-sharing practices and underscores the urgency of completing the DSA restructuring.
Global Privacy Control Gap. Cascade does not currently honor the Global Privacy Control ("GPC") signal, which is a universal opt-out mechanism recognized under CCPA/CPRA regulations (11 CCR § 7025) and increasingly required under other state privacy statutes. The failure to honor GPC signals is a compliance gap that directly intersects with the Thornbridge data flow: even if Cascade were to begin honoring GPC signals on its own properties, the lack of a contractual mechanism to pass through those signals to Thornbridge would leave a downstream compliance gap. The deployment of a consent management platform by OnPoint Data Solutions Inc. (target deployment date December 15, 2025) is intended to close this gap on the Cascade side, but the Thornbridge DSA must be in place to operationalize GPC signal pass-through on the downstream side.
FTC Scrutiny. The Federal Trade Commission issued a Civil Investigative Demand to Cascade (File No. 232-0147, issued September 14, 2023, and closed April 3, 2024) regarding allegations of dark patterns in Cascade's consumer-facing data practices. Although the CID was ultimately closed without enforcement action, the investigation underscores the ongoing regulatory scrutiny of Cascade's consumer-facing data practices and the importance of ensuring that Cascade's contractual arrangements with data-sharing partners reflect robust consumer-protection standards.
Multi-State Compliance Requirements. In addition to the CCPA/CPRA, Cascade's operations trigger obligations under the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("Colorado CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), and numerous other state privacy statutes. Under these statutes, consumers have the right to opt out of the sale of personal information and/or targeted advertising, and businesses must honor opt-out signals, including GPC where applicable. The restructured DSA must address compliance obligations across all applicable jurisdictions, not only California.
C. Negotiation Procedural History
The negotiation of the restructured DSA has proceeded on the following timeline:
•  September 18, 2025: C&H circulated the initial draft DSA to Victor Sandoval at KP&A and to Leah Voss, General Counsel of Thornbridge, via email. The draft consisted of 14 substantive sections plus definitions, schedules, and exhibits, and was accompanied by a cover letter identifying the principal commercial and regulatory objectives underlying the restructuring.
•  October 3, 2025: KP&A returned a marked counterproposal to C&H, containing substantive redlines to 14 of the DSA's sections. The counterproposal was accompanied by a brief cover memorandum from Mr. Sandoval identifying Thornbridge's primary concerns and stating Thornbridge's position that several of C&H's proposed provisions exceeded what is legally required for a third-party data-sharing arrangement. The counterproposal is attached to this memorandum as Attachment A (not reproduced herein).
•  October 6, 2025: Alan Burke (C&H) and Victor Sandoval (KP&A) held a preliminary review call to identify the major areas of disagreement and to assess the parties' relative flexibility on each issue. During the call, Mr. Sandoval indicated that the combined-data rights issue (Section 4.2) and the indemnification issue (Section 11.2) were of the highest commercial priority to Thornbridge, while the GPC signal issue (Section 7.3) and the audit rights issue (Section 9.1) were primarily operational concerns that Thornbridge believed could be resolved with appropriate transitional provisions.
This memorandum sets forth C&H's analysis of the four principal negotiation issues and the five lower-priority issues, together with recommended positions, for use in the next round of negotiations.
III. Issue 1: Combined-Data Rights (Section 4.2 of Draft DSA)
A. Cascade's Position in Draft
Section 4.2 of C&H's initial draft DSA prohibits Thornbridge from combining Cascade consumer personal information ("PI") with personal information that Thornbridge receives from or on behalf of any other person or entity, or that Thornbridge collects from its own direct interactions with consumers. This restriction is comprehensive in scope and applies to all forms of combination, including data matching, appending, enrichment, co-mingling in shared datasets, and use of Cascade consumer PI as seed data for audience-modeling products.
This restriction was drafted to mirror the combination prohibition set forth in CCPA § 1798.140(j)(1)(A)(iv), which applies to "service providers" and "contractors" under the statute. Although Thornbridge has been classified as a "third party" under the CCPA (and therefore the statutory combination prohibition does not apply directly), Cascade's draft imposes an analogous restriction as a contractual safeguard. The rationale for this approach is threefold:
First, the combination restriction supports Cascade's position that it has implemented reasonable controls over the downstream use of consumer personal information, which is relevant to Cascade's defense posture in the event of any future regulatory inquiry or enforcement action.
Second, the restriction is consistent with the purpose-limitation principles embedded in the VCDPA, Colorado CPA, CTDPA, and other applicable state privacy statutes, which generally require that personal information be processed only for specified, disclosed purposes and not be further processed in a manner incompatible with those purposes.
Third, the restriction reflects Cascade's consumer-facing commitments. The forthcoming omnibus privacy policy will represent to consumers that data shared with advertising partners is used for specified advertising purposes on Cascade's behalf, not for the development of Thornbridge's proprietary data products or for the benefit of Thornbridge's other clients.
B. Thornbridge/KP&A Counterproposal
KP&A's redline deletes the combination prohibition in Section 4.2 entirely and replaces it with a provision that affirmatively permits Thornbridge to combine Cascade consumer data with the following categories of data:
•  Thornbridge's proprietary audience segments and behavioral data;
•  Third-party data obtained by Thornbridge from data brokers, data aggregators, and other commercial data sources; and
•  Data received by Thornbridge from its other advertising clients.
The only safeguard imposed under KP&A's counterproposal is a requirement that Thornbridge de-identify the combined data within 90 days after the date of combination. During the 90-day period, Thornbridge would be free to use the combined data — including identifiable Cascade consumer PI — in its audience-modeling, lookalike-audience, and cross-client advertising products without restriction.
In the cover memorandum accompanying the counterproposal, Mr. Sandoval articulated Thornbridge's commercial rationale for this position: Thornbridge's core value proposition as an advertising platform depends on cross-client data aggregation. Thornbridge's audience-modeling and lookalike-audience products require the ability to analyze and combine behavioral data across its entire client base to identify consumer patterns and build predictive models. Prohibiting combination would, in Thornbridge's view, fundamentally undermine the services for which Cascade pays $18.4 million annually and would reduce the performance of Cascade's own programmatic campaigns.
KP&A also advanced a legal argument in support of the counterproposal: because Thornbridge receives data as a "third party" under the CCPA (not as a service provider or contractor), the combination restriction set forth in CCPA § 1798.140(j)(1)(A)(iv) is not legally mandated. KP&A argued that imposing service-provider-level restrictions on a third-party relationship is legally unnecessary and commercially disproportionate.
C. Legal Risk Assessment
KP&A's legal argument is technically correct as a matter of statutory interpretation: the CCPA does not impose a statutory combination restriction on entities classified as "third parties" in the same manner that it restricts "service providers" and "contractors." The combination prohibition in § 1798.140(j)(1)(A)(iv) is a definitional element of the service-provider classification, and because Thornbridge falls outside that classification, the specific statutory provision does not apply.
However, KP&A's argument does not account for the broader compliance risks and regulatory expectations that inform Cascade's position. Permitting unrestricted combination of Cascade consumer PI with data from other sources creates the following risks:
(a) Regulatory-defense risk. Unrestricted combination undermines Cascade's ability to demonstrate to regulators — including the California Privacy Protection Agency ("CPPA"), state attorneys general, and the FTC — that Cascade has implemented "reasonable" data-governance controls over downstream data use. In the current enforcement environment, regulators have increasingly scrutinized the substance of businesses' contractual controls over third-party data sharing, and the absence of combination restrictions could be characterized as a governance failure.
(b) Consumer-disclosure risk. Permitting unrestricted combination is inconsistent with Cascade's consumer-facing representations. The forthcoming omnibus privacy policy (draft dated September 12, 2025) will represent that personal information shared with advertising partners is used for specified purposes related to Cascade's marketing activities. If Thornbridge is permitted to combine Cascade consumer PI with data from other clients and other sources for Thornbridge's own proprietary products, Cascade's privacy-policy disclosures will be materially incomplete or misleading.
(c) Regulatory-inquiry risk. In the event of any future inquiry by the California Attorney General, the CPPA, or the FTC, the permissive combination provision would likely be viewed unfavorably. The February 2024 informal inquiry from the California AG's Office already flagged deficiencies in Cascade's data-sharing arrangements, and a DSA that affirmatively permits unrestricted data combination would not demonstrate meaningful remediation.
(d) Multi-state compliance risk. The data-minimization and purpose-limitation principles embedded in the Colorado CPA, CTDPA, OCPA, and other state statutes create additional risk. These statutes generally require that personal data processing be limited to what is reasonably necessary for disclosed purposes. Permitting Thornbridge to combine Cascade consumer PI with cross-client data for Thornbridge's proprietary purposes may constitute processing that exceeds the scope of the purposes disclosed to consumers.
Risk rating: High. Unrestricted combination undermines the compliance posture of the entire DSA restructuring and creates enforcement risk across multiple jurisdictions. This issue is the single most significant compliance concern in the KP&A counterproposal.
D. Recommended Negotiation Position
Primary position: Maintain the combination prohibition as drafted in Section 4.2, with a narrow carve-out allowing Thornbridge to combine Cascade consumer PI with Thornbridge's proprietary first-party data solely for the purpose of performing services under the DSA (i.e., Cascade-directed programmatic campaigns). This carve-out would be subject to the following conditions:
(i) The combined data may be used only to perform services directed by Cascade under the DSA and may not be used for the benefit of any other Thornbridge client, for the development of Thornbridge's proprietary data products, or for any purpose not expressly authorized by Cascade in writing;
(ii) Thornbridge must maintain technical and organizational controls to segregate combined datasets from Thornbridge's general-purpose data assets;
(iii) Combined datasets must be subject to the same use restrictions, opt-out obligations, and audit rights applicable to Cascade consumer PI under the DSA; and
(iv) Thornbridge must provide annual written certification from its privacy officer confirming compliance with the combination restrictions.
This carve-out is designed to address Thornbridge's legitimate commercial need to leverage its first-party data assets in performing services for Cascade, while preventing the downstream use of Cascade consumer PI for Thornbridge's proprietary purposes or for the benefit of other Thornbridge clients.
Fallback position: If Thornbridge will not accept the primary position, Cascade may consider permitting combination only in pseudonymized form — not merely de-identified within 90 days as proposed by KP&A, but pseudonymized at the point of combination using industry-standard pseudonymization techniques. This fallback would be subject to the following additional conditions:
(a) A contractual prohibition on re-identification of the pseudonymized data, with technical controls to prevent re-identification;
(b) A contractual commitment that combined datasets are not used to target, profile, or serve advertising to Cascade consumers on behalf of any third party;
(c) Annual certification from Thornbridge's privacy officer confirming compliance with the combination and pseudonymization requirements; and
(d) Cascade audit rights over the combination environment, including the right to verify that pseudonymization has been properly implemented and that re-identification controls are effective.
Red line (non-negotiable): Cascade should not agree to unrestricted combination with de-identification on a 90-day lag, as proposed in the KP&A counterproposal. The 90-day window creates an extended open period during which identifiable Cascade consumer personal information is used in combined form without adequate safeguards. This approach is inconsistent with Cascade's compliance objectives and creates unacceptable regulatory risk. This position should be communicated clearly to KP&A at the outset of the next negotiation session to avoid protracted discussions on a formulation that Cascade cannot accept.
IV. Issue 2: Real-Time GPC Signal Pass-Through (Section 7.3 of Draft DSA)
A. Cascade's Position in Draft
Section 7.3 of C&H's initial draft DSA requires Thornbridge to honor Global Privacy Control ("GPC") signals passed through by Cascade in real time — that is, at the time of each ad request or data transmission. Under this provision, when a consumer has enabled GPC in their browser or device settings, Cascade will include a GPC flag in its data transmissions to Thornbridge, and Thornbridge must suppress the sale and/or sharing of that consumer's personal information immediately upon receipt of the GPC signal. The suppression obligation applies to all downstream processing by Thornbridge, including programmatic ad targeting, audience modeling, and data combination (to the extent combination is permitted under Section 4.2).
This provision is designed to close a critical compliance gap identified in the C&H gap-analysis report: Cascade currently does not honor GPC signals, and no downstream mechanism exists to transmit opt-out preferences to Thornbridge or other data-sharing partners. The deployment of a consent management platform ("CMP") by OnPoint Data Solutions Inc. is targeted for December 15, 2025. The OnPoint CMP will enable real-time GPC detection at the point of consumer interaction with Cascade's digital properties and will generate API-level opt-out signals that can be transmitted to downstream data recipients. The restructured Thornbridge DSA must be in place to operationalize this downstream signal pass-through.
The real-time processing requirement reflects the regulatory expectation that opt-out preferences be honored promptly and that no processing inconsistent with the consumer's opt-out election occur after the signal has been transmitted. This expectation is grounded in the CCPA/CPRA regulations, California AG/CPPA guidance, and analogous provisions of the Colorado CPA, CTDPA, and other state statutes.
B. Thornbridge/KP&A Counterproposal
KP&A's redline modifies Section 7.3 to substitute batch processing for real-time processing. Under the counterproposal, Thornbridge would process opt-out signals on a weekly batch basis, updated every Sunday at midnight Pacific Time, rather than in real time at the point of each data transmission.
Thornbridge's stated rationale for this position, as articulated by Mr. Sandoval during the October 6, 2025 preliminary review call, is twofold:
First, Thornbridge's existing ad-serving infrastructure is not currently configured to process per-impression opt-out signals. Thornbridge's platform operates on a pre-built audience-segment model in which consumer data is processed and segmented in advance of ad-serving events, and audience segments are refreshed on a periodic (currently weekly) cycle. Introducing real-time, per-impression opt-out processing would require significant re-engineering of Thornbridge's data pipeline and ad-serving architecture.
Second, Thornbridge asserts that real-time opt-out processing would degrade the performance of its ad-targeting algorithms by introducing latency into the ad-serving process. Thornbridge contends that the incremental compliance benefit of real-time processing (as compared to weekly batch processing) does not justify the engineering cost and performance degradation.
As an alternative to real-time processing, KP&A's counterproposal includes a 6-month implementation runway. Under this alternative, Thornbridge would have until April 30, 2026 to build real-time GPC processing capability, with weekly batch processing serving as an interim measure during the implementation period.
C. Legal Risk Assessment
The legal risk associated with KP&A's weekly-batch-processing proposal is significant and, in C&H's assessment, renders the proposal indefensible under current CCPA/CPRA regulations.
CCPA/CPRA regulations at 11 CCR § 7025 require businesses to treat the GPC signal as a valid request to opt out of the sale and sharing of personal information. The regulations further require that businesses process opt-out requests and cease the sale or sharing of personal information "as soon as commercially reasonable" and, in the case of online interactions, generally before the next interaction with the consumer. Weekly batch processing creates a window of up to seven days during which a consumer who has enabled GPC continues to have their personal information sold or shared by Thornbridge, notwithstanding the consumer's clearly expressed opt-out preference. This delay is inconsistent with the "as soon as commercially reasonable" standard and would expose Cascade to enforcement risk in the event of a CPPA or California AG investigation.
The risk is amplified by the scale of the data involved. Given that Thornbridge processes data associated with approximately 41.2 million Cascade Rewards members and approximately 2.1 billion consumer-event data records per month, a seven-day lag in opt-out processing could affect millions of consumer interactions per processing cycle.
The Colorado CPA and Connecticut CTDPA also require businesses to honor universal opt-out mechanisms, with similar expectations regarding timeliness of implementation. To the extent consumers in those jurisdictions enable GPC or equivalent signals, Cascade's obligations extend beyond California.
Risk rating: High. Weekly batch processing is not legally defensible under current CCPA/CPRA regulations and creates substantial enforcement risk for Cascade. The 6-month implementation runway proposed by KP&A would extend the period of non-compliance well beyond the Phase 1 milestone date and into the period during which the OnPoint CMP will be operational, creating a mismatch between Cascade's consumer-facing compliance posture and its actual downstream data practices.
D. Recommended Negotiation Position
Primary position: Maintain the real-time GPC signal pass-through requirement as drafted in Section 7.3. Cascade's CMP deployment (OnPoint Data Solutions Inc., target deployment December 15, 2025) is being designed to transmit GPC signals at the API level in real time. The Thornbridge DSA should require Thornbridge to match this capability so that the end-to-end system — from consumer signal to downstream data suppression — operates in real time without compliance gaps.
Fallback position: C&H recognizes that Thornbridge may require a limited transition period to build the necessary technical infrastructure. If Thornbridge cannot commit to real-time processing at DSA execution, Cascade may accept a transition period subject to the following conditions:
(i) The transition period must not exceed 60 days from the date of DSA execution — i.e., approximately December 31, 2025, aligning with the Phase 1 completion date. A 6-month runway to April 30, 2026, as proposed by KP&A, is excessive and unacceptable.
(ii) During the transition period, Thornbridge must process batch opt-outs on a daily basis (not weekly). Daily batch processing reduces the compliance gap from seven days to approximately 24 hours, which, while not ideal, is significantly more defensible than weekly processing.
(iii) After the expiration of the transition period, real-time processing is mandatory. The DSA should include a contractual milestone requiring Thornbridge to demonstrate real-time GPC processing capability no later than the end of the transition period, with Cascade having the right to conduct a technical review or audit to verify implementation.
Additional safeguard: Regardless of the agreed-upon transition timeline, C&H recommends that Cascade require Thornbridge to implement a "suppression by default" rule during the transition period. Under this rule, if Thornbridge cannot affirmatively confirm opt-in status for a consumer located in California, Colorado, or Connecticut at the time of an ad request, Thornbridge must suppress the sale and sharing of that consumer's personal information. This approach shifts the default from "process unless opt-out is confirmed" to "suppress unless opt-in is confirmed," which is a significantly more conservative and defensible posture during the transition period. While this approach may result in some over-suppression and a temporary reduction in ad-targeting performance, it protects Cascade against the risk of processing consumer data in violation of opt-out preferences during the transition.
Red line (non-negotiable): Weekly batch processing is unacceptable under any circumstance, whether as an interim measure or otherwise. Any agreed-upon transition period must be strictly time-limited, must include daily (not weekly) batch processing as the minimum interim measure, and must terminate in a binding obligation to implement real-time processing. Cascade cannot accept an open-ended or indefinite transition to real-time processing.
V. Issue 3: Audit Rights (Section 9.1 of Draft DSA)
A. Cascade's Position in Draft
Section 9.1 of C&H's initial draft DSA grants Cascade, or a third-party auditor designated by Cascade, the right to audit Thornbridge's data-processing practices, facilities, and records for compliance with the DSA. The audit right is exercisable upon 30 days' written notice and may be exercised up to two times per calendar year.
The scope of the audit right, as drafted, encompasses the following:
•  Inspection of data systems, servers, and storage environments in which Cascade consumer PI is processed or maintained;
•  Interviews with relevant Thornbridge personnel involved in data processing, including engineering, data-science, and privacy/compliance staff;
•  Review of technical and organizational security measures implemented by Thornbridge to protect Cascade consumer PI;
•  Verification of compliance with the data-combination restrictions set forth in Section 4.2 (Issue 1 above);
•  Verification of compliance with the GPC signal-processing requirements set forth in Section 7.3 (Issue 2 above);
•  Review of data-retention and deletion practices; and
•  Review of incident-response and breach-notification procedures.
Audit rights are required contractual provisions under CCPA/CPRA for service-provider and contractor agreements. Although the statutory audit requirement does not apply directly to third-party arrangements, the inclusion of audit rights in a third-party DSA is a recognized best practice and is necessary for Cascade to verify ongoing compliance with the contractual safeguards that substitute for the statutory protections that would otherwise apply in a service-provider relationship. Audit rights are also mandated by the VCDPA, Colorado CPA, CTDPA, and other state privacy statutes for data-processing agreements, and while these mandates technically apply to "processor" (rather than "third-party") relationships, the inclusion of audit rights in the Thornbridge DSA strengthens Cascade's overall compliance posture.
B. Thornbridge/KP&A Counterproposal
KP&A's redline modifies Section 9.1 in several material respects:
(a) Frequency reduction. KP&A reduces the audit frequency from twice per calendar year to once per calendar year.
(b) Duration limitation. KP&A imposes a maximum audit duration of 3 business days, regardless of the scope or complexity of the audit.
(c) Auditor-selection restriction. KP&A requires that audits be conducted by a mutually agreed independent auditor. Cascade would not be permitted to use its internal audit team or to unilaterally select a third-party auditor. This provision effectively gives Thornbridge veto power over auditor selection.
(d) SOC 2 substitution. KP&A provides that Thornbridge may satisfy its audit obligations by providing an annual SOC 2 Type II report, or equivalent third-party certification, in lieu of permitting an on-site audit.
(e) Cost allocation. KP&A provides that Cascade bears the full cost of any audit conducted under Section 9.1.
Thornbridge's stated rationale for these modifications, as conveyed by Mr. Sandoval, relates to audit disruption, cost burden, and the protection of Thornbridge's proprietary ad-tech algorithms and trade secrets. Mr. Sandoval emphasized that Thornbridge's platform incorporates proprietary machine-learning models and algorithmic processes that constitute core trade secrets, and that unrestricted audit access could expose these proprietary assets to Cascade or its auditors.
C. Legal Risk Assessment
The risk profile of the KP&A audit provisions varies by subissue:
Frequency. Reducing to once per calendar year is not per se legally non-compliant. No applicable statute mandates a specific audit frequency for third-party data-sharing relationships. However, once-per-year auditing limits Cascade's ability to verify ongoing compliance during the initial implementation period — precisely the period during which compliance risks are highest as new contractual provisions (combination restrictions, GPC processing, opt-out handling) are being operationalized for the first time.
SOC 2 substitution. The SOC 2 Type II substitution provision is the most concerning element of KP&A's counterproposal on this issue. A standard SOC 2 Type II report is designed around the American Institute of CPAs' trust-service criteria (security, availability, processing integrity, confidentiality, and privacy) and evaluates whether an organization's controls are suitably designed and operating effectively over a specified review period. However, a SOC 2 report is not designed to assess compliance with the specific contractual obligations in the DSA — including combination prohibitions, GPC signal handling, purpose-limitation restrictions, and data-retention requirements. A SOC 2 report may confirm that Thornbridge maintains adequate security controls in a general sense while providing no assurance whatsoever regarding Thornbridge's compliance with the substantive data-use restrictions in the DSA.
Auditor selection. The mutual-agreement requirement for auditor selection is problematic because it could function as a de facto veto right. If Thornbridge refuses to agree on an auditor proposed by Cascade, the audit mechanism is effectively neutralized. This risk is particularly acute in scenarios where Cascade suspects non-compliance and seeks an audit on an expedited basis — the mutual-agreement requirement could create delays that undermine the audit's effectiveness.
Cost allocation. The cost-allocation provision is not inherently unreasonable, but it should be qualified: if an audit reveals material non-compliance, Thornbridge — not Cascade — should bear the audit costs.
Risk rating: Medium. Once-per-year audit frequency is workable with appropriate supplemental protections, but the SOC 2 substitution provision and the mutual-agreement auditor-selection requirement, taken together, could effectively eliminate Cascade's ability to conduct meaningful compliance verification. These provisions must be modified.
D. Recommended Negotiation Position
Primary position: Maintain the twice-per-year audit right for the first two years of the DSA term, covering the critical implementation and ramp-up period during which new contractual obligations are being operationalized. After the initial two-year period, the audit frequency would reduce to once per calendar year. Cascade would retain the right to select its auditor unilaterally, subject to the auditor's execution of a reasonable confidentiality agreement with Thornbridge to protect Thornbridge's proprietary information.
Fallback position: If Thornbridge will not accept twice-per-year auditing, Cascade may accept once per calendar year as the baseline audit frequency, subject to the following conditions:
(a) For-cause audit right. In addition to the scheduled annual audit, Cascade retains the right to conduct an additional "for cause" audit at any time, triggered by any of the following events: (i) a suspected or confirmed breach of the DSA by Thornbridge; (ii) a regulatory inquiry, investigation, or enforcement action by any governmental authority relating to Thornbridge's processing of Cascade consumer PI; (iii) a consumer complaint received by Cascade relating to Thornbridge's data processing; or (iv) a material change in Thornbridge's data-processing practices, infrastructure, or personnel. For-cause audit rights are not subject to frequency limitations.
(b) SOC 2 as supplemental evidence. SOC 2 Type II reports, or equivalent third-party certifications, are acceptable as supplemental evidence of Thornbridge's general security posture. However, SOC 2 reports do not satisfy the audit obligation and cannot substitute for a DSA-specific audit. Cascade must retain the right to conduct an on-site or remote audit focused specifically on Thornbridge's compliance with the substantive provisions of the DSA, including combination restrictions, GPC signal processing, purpose limitations, and data-retention requirements.
(c) Unilateral auditor selection. Cascade may designate its auditor unilaterally, without requiring Thornbridge's agreement. However, the designated auditor must execute Thornbridge's standard form of non-disclosure agreement prior to the commencement of the audit. Cascade will not agree to a bespoke or custom NDA negotiation process for each audit, as this could be used to delay or obstruct audits. Thornbridge's standard NDA, applied without modification, is the appropriate mechanism.
(d) Cost allocation. Audit costs are borne by Cascade as the requesting party, unless the audit reveals a material breach of the DSA by Thornbridge, in which case Thornbridge bears the full costs of the audit.
Concession available: C&H recommends that Cascade offer the following concessions to facilitate agreement on this issue:
(i) Duration cap. Agree to a maximum audit duration of 5 business days (rather than the unlimited duration implied by C&H's draft or the 3-business-day cap proposed by KP&A). Five business days provides sufficient time for a meaningful audit of DSA-specific obligations while addressing Thornbridge's concerns about operational disruption.
(ii) Trade-secret protections. Agree that auditors may review Thornbridge's data practices, technical and organizational controls, data flows, and processing logs without requiring access to Thornbridge's proprietary algorithmic source code or machine-learning model architecture. This concession addresses Thornbridge's legitimate trade-secret concerns without impairing the audit's ability to verify compliance with the DSA's substantive provisions.
Red line (non-negotiable): Cascade must retain the right to select its auditor unilaterally, subject only to the auditor's execution of Thornbridge's standard NDA. A mutual-agreement requirement that gives Thornbridge veto power over auditor selection is unacceptable. Additionally, SOC 2 Type II reports cannot fully substitute for a DSA-specific audit. These two points are essential to preserving the integrity and functionality of the audit mechanism.
VI. Issue 4: Indemnification Scope for Regulatory Fines (Section 11.2 of Draft DSA)
A. Cascade's Position in Draft
Section 11.2 of C&H's initial draft DSA provides that Thornbridge will indemnify, defend, and hold harmless Cascade and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, fines, penalties, enforcement costs, attorneys' fees, and expenses arising from or relating to:
(a) Thornbridge's breach of any provision of the DSA; or
(b) Thornbridge's violation of any applicable privacy law, data-protection statute, or regulation in connection with Thornbridge's processing of Cascade consumer personal information.
The indemnification obligation expressly covers regulatory fines, penalties, or assessments imposed by the California Privacy Protection Agency ("CPPA"), any state attorney general, the Federal Trade Commission, or any other governmental authority. The coverage extends to both compensatory and non-compensatory regulatory assessments, including civil penalties, statutory fines, and consent-decree monetary obligations.
Cascade's draft does not include a cap on the aggregate amount of indemnification. This reflects Cascade's view that the indemnification obligation should be commensurate with the magnitude of the potential regulatory exposure, particularly given the scale of the data involved and the per-violation penalty structure of the CCPA and other applicable statutes.
B. Thornbridge/KP&A Counterproposal
KP&A's redline modifies Section 11.2 to limit Thornbridge's indemnification obligation in the following respects:
(a) Exclusion of regulatory fines and penalties. KP&A's primary position is that regulatory fines and penalties should be excluded entirely from the scope of Thornbridge's indemnification obligation. Under this formulation, Thornbridge would indemnify Cascade only for direct damages, including costs of defense and settlement of private claims brought by consumers or other private parties, but would bear no responsibility for regulatory fines or penalties, regardless of whether such fines or penalties are attributable to Thornbridge's breach of the DSA or Thornbridge's violation of applicable law.
(b) Alternative indemnification cap. As an alternative to the complete exclusion of fines, KP&A proposes that, if regulatory fines and penalties are included within the scope of indemnification, Thornbridge's aggregate indemnification obligation be capped at an amount equal to the fees paid by Cascade to Thornbridge in the twelve months preceding the date of the claim giving rise to the indemnification obligation. Based on Cascade's FY2024 spend, this cap would be approximately $18.4 million.
(c) Mutual-fault carve-out. KP&A's redline includes a carve-out providing that Thornbridge's indemnification obligation does not extend to fines, penalties, or damages that are attributable, in whole or in part, to Cascade's own acts or omissions — for example, Cascade's failure to properly transmit opt-out signals to Thornbridge, Cascade's failure to make adequate consumer disclosures, or other compliance failures on the Cascade side of the data flow.
In support of the exclusion of regulatory fines, KP&A cites public-policy arguments. Specifically, KP&A contends that contractual indemnification for regulatory fines and penalties may be unenforceable in certain jurisdictions on the ground that indemnification would shift the punitive impact of the fine away from the party whose conduct the regulator intended to sanction, thereby undermining the deterrent purpose of the fine. KP&A further argues that imposing uncapped indemnification for regulatory fines is commercially unreasonable given the volume of data processed and the magnitude of potential per-violation penalties under the CCPA.
C. Legal Risk Assessment
KP&A's public-policy argument regarding the enforceability of fine-indemnification provisions has some analytical merit but is unlikely to prevail as a general matter. The enforceability of contractual indemnification for regulatory fines and penalties varies by jurisdiction:
•  Some jurisdictions have held that contractual indemnification for punitive damages or government-imposed penalties is against public policy, on the theory that allowing indemnification defeats the deterrent purpose of the penalty.
•  However, the majority position among courts addressing this issue — particularly in commercial disputes between sophisticated parties — permits contractual allocation of regulatory fines between the parties, particularly where the indemnifying party's conduct was the proximate cause of the fine. This is especially true where, as here, the indemnification provision allocates responsibility to the party whose breach or non-compliance triggered the regulatory action.
•  Delaware law (which C&H has proposed as the governing law for the DSA) generally enforces contractual indemnification provisions as written between sophisticated commercial parties, including provisions covering regulatory fines and penalties, subject to the usual limitations on indemnification for a party's own willful misconduct.
The aggregate cap proposed by KP&A (trailing 12-month fees, approximately $18.4 million) is within market range for data-sharing agreements of comparable scale. However, it is lower than Cascade's potential regulatory exposure. Under the CCPA, statutory penalties range from $2,500 per unintentional violation to $7,500 per intentional violation. Given the scale of Cascade's data operations — approximately 94 million annual online transactions, approximately 41.2 million loyalty-program members, and approximately 2.1 billion monthly consumer-event data records flowing through Peakview Analytics — the theoretical per-violation penalty exposure is substantial. While regulators have not historically imposed penalties at the full theoretical maximum, the potential exposure significantly exceeds the $18.4 million cap proposed by KP&A.
Cascade's own cyber and privacy-liability insurance, underwritten by Northcastle Indemnity Company, provides $25 million per occurrence and $50 million in annual aggregate coverage (policy period July 1, 2025 through June 30, 2026, with an annual premium of $1,340,000). While the insurance program provides a backstop, Cascade should not rely on insurance coverage as a substitute for contractual risk allocation with Thornbridge. Insurance coverage is subject to policy exclusions, deductibles, and coverage disputes, and Cascade's premium costs would likely increase in the event of a claim, regardless of whether Thornbridge bears contractual responsibility.
The mutual-fault carve-out proposed by KP&A (item (c) above) is reasonable and appropriate. Cascade should not seek indemnification from Thornbridge for fines or penalties that are attributable to Cascade's own compliance failures — for example, Cascade's failure to properly configure its CMP to detect and transmit GPC signals, or Cascade's failure to make adequate consumer disclosures in its privacy policy. Including a proportional-fault allocation mechanism for mixed-fault scenarios would be appropriate and consistent with equitable principles.
Risk rating: Medium-High. The total exclusion of regulatory fines from indemnification is unacceptable and would leave Cascade bearing the full financial impact of fines caused by Thornbridge's non-compliance. A reasonable cap with appropriate conditions is negotiable, but the cap must be set at a level commensurate with the risk profile.
D. Recommended Negotiation Position
Primary position: Maintain the indemnification provision as drafted, covering regulatory fines and penalties without an aggregate cap, where the fine or penalty arises from Thornbridge's breach of the DSA or Thornbridge's independent violation of applicable law in connection with its processing of Cascade consumer PI. C&H's view is that Thornbridge, as the party whose conduct triggers the regulatory action, should bear the financial consequences without an arbitrary cap, particularly where the indemnification obligation is limited to fines caused by Thornbridge's own breach or non-compliance.
Fallback position: If Thornbridge insists on an aggregate cap, Cascade should accept a cap set at 2x the trailing 12-month fees paid by Cascade to Thornbridge (i.e., approximately $36.8 million based on current spend levels). A 2x multiplier is more consistent with the risk profile of the arrangement, given the scale of data processing and Cascade's potential regulatory exposure, and is within the range of caps observed in comparable data-sharing agreements for enterprises of similar scale. Regulatory fines and penalties must remain within the scope of the capped indemnification — any formulation that excludes fines entirely, even within a cap, is not acceptable.
Alternative fallback: If Thornbridge will not accept a 2x cap, Cascade may consider a cap of 1.5x the trailing 12-month fees (i.e., approximately $27.6 million based on current spend). C&H recommends that 1.5x be treated as the absolute floor for this negotiation. A cap lower than 1x trailing 12-month fees ($18.4 million) is not recommended, as it would effectively cap Cascade's recovery at an amount that may be insufficient to cover even a moderate regulatory fine in the CCPA context.
Accepted concession: The mutual-fault carve-out proposed by KP&A is reasonable and should be accepted. Cascade should not seek indemnification from Thornbridge for fines, penalties, or damages that are attributable to Cascade's own acts or omissions, including:
•  Cascade's failure to properly configure, deploy, or maintain the OnPoint CMP or to transmit opt-out signals to Thornbridge in accordance with the DSA's technical specifications;
•  Cascade's failure to make adequate disclosures in its consumer-facing privacy policy;
•  Cascade's failure to respond to consumer rights requests directed to Cascade; or
•  Any other compliance failure on the Cascade side of the data flow.
For scenarios involving mixed fault — i.e., where both Cascade's and Thornbridge's conduct contributed to the regulatory fine — C&H recommends including a proportional-fault allocation mechanism. Under this mechanism, Thornbridge's indemnification obligation would be reduced in proportion to the degree to which Cascade's own acts or omissions contributed to the fine. The proportional-fault determination would be made by mutual agreement of the parties or, in the event of a dispute, by the dispute-resolution mechanism set forth in the DSA.
Red line (non-negotiable): Regulatory fines and penalties must remain within the scope of Thornbridge's indemnification obligation. The total exclusion of fines from indemnification — as proposed in KP&A's primary position — is unacceptable under any circumstances. A DSA that does not require Thornbridge to bear financial responsibility for fines caused by its own non-compliance fails to achieve one of the core risk-allocation objectives of the restructuring.
VII. Additional Redline Issues (Lower Priority)
In addition to the four principal issues analyzed above, KP&A's counterproposal includes redlines to several additional DSA provisions. C&H's analysis and recommended positions on these lower-priority issues are set forth below. None of these issues presents a compliance risk comparable to Issues 1 through 4, and each is amenable to a reasonable compromise.
A. Definition of "Personal Information" (Section 1.1)
KP&A's redline narrows the definition of "Personal Information" in Section 1.1 to exclude de-identified data and aggregated data from the scope of the term. Upon review, C&H's initial draft already excludes de-identified and aggregated data from the definition, consistent with the exclusions set forth in CCPA § 1798.140(v). Accordingly, there is no substantive disagreement between the parties on this point. C&H recommends confirming alignment with KP&A on the precise definitional language to ensure consistency with the CCPA statutory definitions and to avoid any ambiguity regarding the treatment of pseudonymized data (which remains within the scope of "Personal Information" under the CCPA, unlike de-identified data).
B. Data Deletion / Return on Termination (Section 12.3)
KP&A's redline requests a 90-day post-termination retention period for Cascade consumer PI, during which Thornbridge would be permitted to retain the data for purposes of winding down any active campaigns and completing any contractually required reporting. C&H's draft requires deletion or return of all Cascade consumer PI within 30 days of termination or expiration of the DSA.
C&H recommends accepting a 60-day compromise as the post-termination retention period. Sixty days provides Thornbridge with reasonable time to wind down active campaigns and complete reporting obligations, while limiting the period during which Cascade consumer PI remains in Thornbridge's possession after the contractual relationship has ended. The 60-day period should be conditioned on the following requirements:
(i) Thornbridge must certify in writing, within 10 business days after the expiration of the 60-day period, that all Cascade consumer PI has been deleted from Thornbridge's systems, including backup and disaster-recovery systems, or returned to Cascade in a format reasonably specified by Cascade.
(ii) During the 60-day retention period, Thornbridge's processing of Cascade consumer PI must be limited strictly to wind-down and reporting purposes; no new campaigns, audience modeling, or data combination may be initiated using Cascade consumer PI during this period.
(iii) All substantive provisions of the DSA (including combination restrictions, opt-out obligations, and security requirements) remain in full force and effect during the 60-day retention period.
C. Breach Notification Timeline (Section 10.2)
KP&A's redline proposes a 72-hour breach notification timeline — i.e., Thornbridge would be required to notify Cascade of any data breach or security incident involving Cascade consumer PI within 72 hours of discovery. C&H's draft requires notification within 48 hours of discovery.
C&H recommends maintaining the 48-hour notification timeline. Cascade's obligation to notify regulators and affected consumers under certain state data-breach notification statutes is typically triggered within 72 hours of the business's discovery of the breach. If Thornbridge is permitted 72 hours to notify Cascade, and Cascade then requires additional time to assess the incident and prepare its own notifications, Cascade may be unable to meet its downstream notification obligations within the applicable statutory timeframes. A 48-hour notification timeline from Thornbridge to Cascade preserves Cascade's ability to conduct its own assessment and meet 72-hour (or shorter) notification windows under applicable state laws.
C&H acknowledges that 48-hour notification may require Thornbridge to provide preliminary or incomplete information in its initial notification. The DSA should clarify that the 48-hour notification obligation requires Thornbridge to provide all information reasonably available at the time of notification, with supplemental information to follow as the investigation progresses. This formulation addresses Thornbridge's likely concern that a compressed notification timeline may result in inaccurate or incomplete initial reports.
D. Governing Law and Dispute Resolution (Section 14)
KP&A's redline proposes Nevada law as the governing law for the DSA, reflecting Thornbridge's state of incorporation. C&H's draft specifies Washington law (the state in which Cascade is headquartered) or, alternatively, Delaware law (Cascade's state of incorporation).
C&H recommends insisting on Delaware law. Delaware offers a neutral forum with well-developed commercial law, a sophisticated judiciary experienced in complex commercial disputes, and predictable case law regarding the enforcement of contractual provisions, including indemnification, limitation-of-liability, and dispute-resolution clauses. Delaware law is consistent with the governing-law provisions in Cascade's other major commercial agreements, which promotes uniformity in Cascade's contract portfolio and reduces the complexity of managing legal obligations across multiple governing-law regimes.
Nevada law is not objectionable on substantive grounds, but Delaware law is preferable for the reasons stated above, and C&H believes KP&A will accept Delaware as a reasonable compromise between the parties' respective home-state preferences.
If KP&A resists Delaware law and agreement on governing law becomes an impediment to closing, C&H recommends offering to accept

PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT

INTERNAL MEMORANDUM

Record

Parties

Dates

Amounts